My computer, the last fews days, will randomly shut windows XP down, and send me to a blue screen with this message:

STOP: c00021a {Fatal System Error} The Windows Logon Process terminated unexpectedly with a system status of oxc0000005 (0x00000000 0x00000000)
The system has been shut down

When I get this I have to shut the computer off and restart it to get back to windows. It has only been doing this about 2-3days and probably about 3-5 times in that time span... what do I do?

I've got Windows XP home edition, Internet Explorer version 6.0
I don't know if you want/need it but my hijack file is below. Also, just FYI Incredimail is my e-mail program so I can't delete otherwise I'll loose my e-mail program. Any help is very much appreciated. Thank you!

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!_________________You want security? Disable Javascript and ActiveX!!

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!_________________You want security? Disable Javascript and ActiveX!!

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

1. Unzip and run LSPFix.
2. Check 'I know what I'm doing'.
3. Select aklsp.dll & dolsp.dll .
4. Click the right-pointing 'arrows' and move all instances of inetadpt.dll and nothing else to the Remove (RHS) side
5. Click the 'Finished' button. (if you exit with the X at top right nothing happens)
6. Now delete c:\windows\system32\aklsp.dll & c:\windows\system32\dolsp.dll

Ok, I followed the steps you gave me. First, none of those programs were in the add/remove program so I couldn't remove them. Second, I could not delete those 2 files: c:\windows\system32\aklsp.dll & c:\windows\system32\dolsp.dll

the computer wouldn't allow me to delete them - it gave the access denied error thing. What should I do to delete them?

1. Unzip and run LSPFix.
2. Check 'I know what I'm doing'.
3. Select inetadpt.dll.
4. Click the right-pointing 'arrows' and move all instances of inetadpt.dll and nothing else to the Remove (RHS) side
5. Click the 'Finished' button. (if you exit with the X at top right nothing happens)
6. Boot into safe mode and delete C:\windows\system32\dolsp.dll
in safe mode.

Now Download the the FindQoologic-Narrator.zip and save it to your Desktop.
(Link below)

Extract (unzip) the files inside into their own folder called FindQoologic.

Open the FindQoologic folder.

Locate and double-click the Activesetup.vbs file to run it.
Please wait until a "Finished" message appears.

When the set-up is complete a file named "Activesetup components[Machine ID][date].txt" will have been saved in the FindQoologic folder.

Locate and double-click the Find-Qoologic.bat to run it.

The tool will open a DOS window and begin to check your system.
When it is finished a text file will open in Notepad called "file.txt".

Save this text file in the FindQoologic folder.

Close the DOS box If on win 98 or me.

Locate the "Activesetup components[Machine ID][date].txt" file and the file you saved.

Hi! First thing, yes I am getting pop-ups... lots and lots of them actually. I even have a pop up blocker (through google searchbar) and it's not helping though it does block some.

The only other problem is that I'm not sure how the DOS stuff runs cause everytime my computer boots up, it pops up with some DOS program thing and tells me there's some sort of error and to either close or ignore it (though if you click ignore, it just pops back up with the same question about close or ignore). When I ran the DOS stuff in Safe mode it still did the same thing.

The other thing I'm noticing is that random junk is installing itself - i.e. virtual bouncer, cashback, search the web stuff, 180 search assistant, web offer... things like this - I get rid of them and they come back... I generally uninstall them through Control Pannel's add/remove program then I go to my computer and search for them to delete the folders but they still come back Don't know if that's helpful to any of the problems with my computer. Thanks much!

Here's the other one:
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Files found in System »»»»»»»»»»»»»»»»»»»»»»»

Go into the FindIt folder that you unzipped and doubleclick the Find.bat file to run it. It will take a few minutes to run so you will have to be patient. Save the results and post them into your next response._________________You want security? Disable Javascript and ActiveX!!

Here's the log you asked for... also I'm getting an insane amount of pop ups... for example, yesterday, within 20 minutes had about 20-25 pop ups... and the same thing is happening today. I can't close them as fast as they come up. What does this mean and how do I get rid of them?
Also, do you want another hijackthis log?

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!_________________You want security? Disable Javascript and ActiveX!!

Sorry it took me a while to respond. I've been rather ill (and still am) but I needed to check some stuff on here. Well, the computer is giving me lots and lots of problems - millions of pop ups, those pop ups keep freezing so it takes me forever just to do one thing, and things are randomly installing themselves on my computer - like dating icons, casino icons, etc... I don't know if that's all due to that look2me thing you told me about or not...

**********************************************************************************
Files Found are not all bad files:
Locate .tmp files:
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is E2EA-C980

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!_________________You want security? Disable Javascript and ActiveX!!

Well, just a few minutes ago as I was trying to type a reply to you and post the logs, my computer gave out again and sent me to that blue screen with the Fatal System Error - it hasn't done that in a while but it did it today (along with the millions of pop up ads that I can't get rid of and stuff downloading itself onto my computer)... I just wish that whatever was happening to my computer would stop but I appreciate all your help and hardwork. Thanks again!

Well, here are the logs you requested:

L2Mfix 1.02b

Running From:
C:\Documents and Settings\Michelle\Desktop\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

The following are the files found:
**********************************************************************

******

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
**********************************************************************

You've got to get yourself some anti-virus protection or you're never going to get clean. Please download http://www.kaspersky.com anti-virus software and update to the newest file definitions. It's free for 30-days that will assist us in removing all the garbage on your system.

Now that you have some Anti-Virus protection, please Run all your scans in safe mode. To boot into safe mode during a reboot, press f8 and select safe mode. Run a couple of scans

open hijackthis 1.99.1
click go to misc tools section
click open unistall manager
you'll see a list of programs in the add/remove programs
click on save list...
it'll save as uninstall_list.txt

You should see entries for Delfin Media Viewer and Wintools. If you do please uninstall them. There are probably more we can uninstall, I just need a list to see what's there.

Ok, as for anti virus protection, I have Norton Antivirus. I've used Kaspersky in the past so it won't let me do the trial version again Hopefully Norton is good... I just realized Norton isn't working right now so I'll have to uninstall and reinstall it tomorrow morning. It worked about a week or 2 weeks ago when I used it last so I'm not sure what happened between then and now.
Also, second problem - I could not boot up in safe mode. I restarted my computer, pressed F8 and got to the black screen, selected Safe Mode, and it went to start up but every time I did this (about 3 times) it froze on the black screen with all the computer words right before booting up should occur (hope that all made sense)... anyways, I followed your instructions and did all those thing in regular Windows XP instead of safe mode... here's what I have:

close ALL your internet explorer windows, and click fix in hijackthis.

Now run the killbox.

Select the Delete on reboot option.

C:\WINDOWS\system32\bitsprx2.exe
Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button.

A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; A second dialog box will ask you if you want to REBOOT now. Press the YES button. If you computer doesn't reboot, please reboot manually.

Post a fresh Hijackthis log in your thread once complete. I can stop the pop-ups, but we just need to get the log cleaned up. You're almost clean too, so don't give up._________________You want security? Disable Javascript and ActiveX!!

Hi! I am very glad that my computer is almost clean! I can't thank you enough.

I followed all your steps, and I'll post the hijack log below... but it seems that some of the files you told me to check off on the hijack log and fix are still there and I tried to fix them twice... not sure why they're so stubborn or how to get rid of them

1. Unzip and run LSPFix.
2. Check 'I know what I'm doing'.
3. Select dolsp.dll.
4. Click the right-pointing 'arrows' and move all instances of inetadpt.dll and nothing else to the Remove (RHS) side
5. Click the 'Finished' button. (if you exit with the X at top right nothing happens)
6. Now locate c:\windows\system32\dolsp.dll and delete it

If you can't delete it, Right-Click on the File > Go To Properties > Make sure Read-Only is not check > If it is, uncheck and try to delete.

Try to boot into safe mode, we've cleaned a lot out. Are you now able to boot into safe mode? Let me know, you're getting close to being clean, very close._________________You want security? Disable Javascript and ActiveX!!

Well I did everything...
Here's the problem I ran into... I used the Housecall and it came with an error saying "clean failed: TROJ-LESER.A" I did this twice and it happened both times... not sure what all that means.
I also ran Norton and it came up clean, no viruses in my system!

I tried to boot in safe mode but it still didn't work and froze up with the same thing - where all those words whiz by, it stops and stays there without booting up fully... not sure why that is.

I don't know if you want another one but here's a new Hijack this log:

When it has downlaoded, run the program and click on the Run Locate.com button. When that has completed, click on the compare button. When that completed click on the make log button. Then post the contents of that log as a reply to this post_________________You want security? Disable Javascript and ActiveX!!

Go into the FindIt folder that you unzipped and doubleclick the Find.bat file to run it. It will take a few minutes to run so you will have to be patient. Save the results and post them into your next response._________________You want security? Disable Javascript and ActiveX!!

I can't seem to get the thing to run and give me a log. I downloaded it and unzipped it but when I click the find.bat file it just pops up with a small black screen for about 2 seconds and all I get the chance to read on it is "File Not Found" There's another sentence above it but it goes by too quickly for me to read it. Not sure what to do now...
Oh, I tried running this find.bat file about 3-4 times but nothing is coming up... I waited for about 45minutes to see if the log would pop up, but it never showed.

Now copy and paste the following line into the 'Full Path to Delete File' Box

C:\WINDOWS\System32\r?ndll.exe

Press the Delete button (the button that looks like a red circle with a white X in it).

A first dialog box will ask if you want to delete the file on reboot, press the YES button.

A second dialog box will ask you if you want to REBOOT now. Press the NO button.

Perform the same procedure on the following files until you reach the last one; A second dialog box will ask you if you want to REBOOT now. Press the YES button.
C:\WINDOWS\System32\WOVADVE.DLL Reboot Here

Well, I downloaded registry lite and entered in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to the address field but I could not find: "etbrun" = C:\windows\system32\eliteneo32.exe"
at all... I even tried to find it using the search that registry lite has. I wasn't sure if not being able to find it was cause it's not there or that I missed it.

My computer seems to be running well, even some of the pop ups have gone away, though sometimes when I step away I still come back to 5-10 popups but that's better that 20-30!

The only other odd thing that happened is when I booted up I got one of those "end processes" send error report/don't send error report things (hope that made sense) this is what it said:
Generic Host Process for Win32 Services encountered a problem and needed to close.
Error signature
szAppName : svchost.exe szAppVer : 0.0.0.0 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

In the right-pane scroll down a look for either rundll.exe or r?ndll.exe, however don't touch rundll32.exe this is a valid MS file that you need.

Once your find either rundll.exe or r?ndll.exe manually delete the file and close out explorer.

I want to run a different program to see if it's clean. In the end, you shouldn't have any pop-ups no matter how long you're away from the computer. So we'll keep digging to find what's causing the pop-ups.

Download the the FindQoologic-Narrator.zip and save it to your Desktop. (Link below)

Extract (unzip) the files inside into their own folder called FindQoologic.

Open the FindQoologic folder.

Locate and double-click the Activesetup.vbs file to run it. Please wait until a "Finished" message appears.

When the set-up is complete a file named "Activesetup components[Machine ID][date].txt" will have been saved in the FindQoologic folder.

Locate and double-click the Find-Qoologic.bat to run it.

The tool will open a DOS window and begin to check your system.

When it is finished a text file will open in Notepad called "file.txt".

Save this text file in the FindQoologic folder.

Close the DOS box If on win 98 or me.

Locate the "Activesetup components[Machine ID][date].txt" file and the file you saved.